Skip to content

T1526 Cloud Service Discovery

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.

Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.21

For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.34

Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable Cloud Logs.

Item Value
ID T1526
Sub-techniques
Tactics TA0007
Platforms Azure AD, Google Workspace, IaaS, Office 365, SaaS
Version 1.3
Created 30 August 2019
Last Modified 04 May 2023

Procedure Examples

ID Name Description
S0677 AADInternals AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.6
S0684 ROADTools ROADTools can enumerate Azure AD applications and service principals.5

Detection

ID Data Source Data Component
DS0025 Cloud Service Cloud Service Enumeration

References

  1. Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020. ↩

  2. Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020. ↩

  3. Microsoft. (2020). Azure Stormspotter GitHub. Retrieved June 17, 2020. ↩

  4. Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019. ↩

  5. Dirk-jan Mollema. (2020, April 16). Introducing ROADtools - The Azure AD exploration framework. Retrieved January 31, 2022. ↩

  6. Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022. ↩